Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40975 Weak Pseudo-Random Number Generation for Secrets in Spring Boot https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40975
Post summary
The text references CVE-2026-40975, noting weak PRNG for secrets in Spring Boot, but offers no PoC, exploit, or patch information.
⚡ New CVE Alert: CVE-2026-40975 📊 Severity: 4.8 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-40975 #CVE-2026-40975 #CVE #Medium #CyberSecurity #InfoSec https://t.co/1kdpvE7CP6
Post summary
The tweet announces the existence of CVE-2026-40975 with medium severity but offers no further technical, exploit, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | spring_boot | - | - | - |